# Discover-Tech digital advertising spyware exploitation

> Live situation record from CLSTR: https://clstr.news/situations/discover-tech-digital-advertising-spyware-exploitation
> Updated: 2026-10-16T19:09:48.000Z. Sources: 83. Developments: 2.

Researchers from Citizen Lab and Confiant have identified a cyber-espionage technique known as ‘AdFection,’ which utilizes digital advertising to deliver ‘zero-click’ spyware. This method allows devices to be compromised simply by loading an advertisement, requiring no user interaction.

Investigations indicate that the Israeli advertising firm Discover-Tech acted as an intermediary, using its ‘Controlium’ platform to facilitate the delivery of spyware developed by Candiru (now Integrity Labs). By purchasing malicious ads through major networks including Google, Yandex, and Microsoft, attackers could identify and compromise specific devices. The malicious advertisements reportedly appeared on hundreds of thousands of websites and mobile applications, generating an estimated 10 million daily impressions. The attack reportedly exploits browser vulnerabilities, potentially a ‘use-after-free in the Skia graphics library,’ to infect devices.

The surveillance has targeted a wide range of individuals and entities, including journalists, activists, and diplomats. Investigations confirmed that at least 45 devices belonging to Al Jazeera journalists were targeted between 2024 and 2025. Other identified targets include networks associated with international organizations such as NATO, the United Nations, the European Commission, the International Criminal Court, and the International Atomic Energy Agency. Government networks in countries including Uruguay, Brazil, and Mexico were also reached.

Following these findings, Google and IAB Europe removed Discover-Tech from their vendor lists due to systematic policy violations. The spyware utilized in these campaigns is capable of accessing private messages, photos, emails, and phone calls, as well as activating device microphones, camera feeds, and location data.

## Claims

- Discover-Tech's network placed ads on nearly 200,000 websites and applications. (disputed by 6 sources)
- Citizen Lab identified Discover-Tech as an intermediary connecting spyware operators to advertising infrastructure. (corroborated by 27 sources)
- The spyware infection can occur without any user interaction or clicking on the advertisement. (corroborated by 27 sources)
- The spyware used in the campaign is developed by the Israeli company Candiru. (corroborated by 27 sources)
- Researchers from Citizen Lab and Confiant identified a new spyware delivery method named ‘AdFection’. (corroborated by 20 sources)
- At least 45 Al Jazeera devices were infected during 2024 and 2025. (corroborated by 18 sources)
- Discover-Tech operated via a platform called Controlium. (corroborated by 15 sources)

## Timeline

### 2026-10-16: Discover-Tech used targeted ads to deliver zero-click spyware

A Citizen Lab investigation reveals the ‘AdFection’ technique, where Israeli firm Discover-Tech used targeted ads to deliver Candiru spyware via zero-click attacks, infecting Al Jazeera staff and UN/NATO-linked

22 sources. https://clstr.news/cluster/discover-tech-accused-of-using-digital-ads-for-zero-click-spyware-attacks

### 2026-10-14: Discover-Tech used digital ads to facilitate zero-click spyware attacks

Researchers have exposed ‘AdFection,’ a zero-click spyware technique using digital ads to infect devices without user interaction, targeting Al Jazeera journalists and various international organizations.

63 sources. https://clstr.news/cluster/israeli-intelligence-uses-digital-ads-and-social-media-for-espionage

---
Cite as: Discover-Tech digital advertising spyware exploitation. CLSTR, https://clstr.news/situations/discover-tech-digital-advertising-spyware-exploitation